Is it possible to implement functionality similar to Apache's mod_ldap InitialBindAsUser:
https://httpd.apache.org/docs/2.4/mod/mod_authnz_ldap.html#authldapinitialbindasuser

...instead of doing just anonymous bind, or bind as a static user, let the LDAP client bind to LDAP as the user whose credentials we're testing in order to validate their group membership, and then Unbind.